CVE-2025-34174

Katalog CVE

CVSS 5.4 · Medium EPSS 10,5%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada pfsense. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions.

Rincian

Terbit di NVD

9 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

10,5% peluang dieksploitasi; lebih tinggi dari 95,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pfsense/FreeBSD-ports/commit/9e412edf62113303c36c7f7d5a48b0a3fb0be893 patch
• https://www.vulncheck.com/advisories/netgate-pf-sense-ce-status-traffic-totals-stored-xss advisory pihak ketiga
• https://redmine.pfsense.org/issues/16413 issue tracking